PT-2019-13748 · Espocrm · Espocrm

Gauravnarwani97 · Publicado 2019-08-05 · Atualizado 2019-08-09 · CVE-2019-14550

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.9

Description The issue allows for stored XSS execution when a victim clicks on the Edit Dashboard feature on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which fires when a user clicks on the Edit Dashboard button, allowing the attacker to steal victims' cookies and compromise their accounts.

Recommendations For versions prior to 5.6.9, update to version 5.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Edit Dashboard feature until the update is applied. Avoid using the add tab list feature in the Edit Dashboard until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-14550

Produtos afetados

Espocrm

Referências · 6

• 🔥 https://github.com/espocrm/espocrm/releases/tag/5.6.9 · Exploit
• 🔥 https://github.com/espocrm/espocrm/commit/ffd3f762ce4a8de3b8962f33513e073c55d943b5 · Exploit
• 🔥 https://github.com/espocrm/espocrm/issues/1369 · Exploit
• 🔥 https://gauravnarwani.com/publications/cve-2019-14550 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14550 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14550 · Aviso do Fabricante